Lucene search

EsriCVE-2021-29107

HistoryJul 10, 2021 - 3:15 p.m.

CVE-2021-29107

2021-07-1015:15:07

CWE-79

Esri

web.nvd.nist.gov

cve

cross site scripting

xss

arcgis

server manager

vulnerability

security

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application.

Affected configurations

Nvd

Node

esriarcgis_serverMatch10.6.1x64

VendorProductVersionCPE
esriarcgis_server10.6.1cpe:2.3:a:esri:arcgis_server:10.6.1:*:*:*:*:*:x64:*

Vendor	Product	Version	CPE
esri	arcgis_server	10.6.1	cpe:2.3:a:esri:arcgis_server:10.6.1::::::x64:

CNA Affected

[
  {
    "platforms": [
      "x64"
    ],
    "product": "ArcGIS Server",
    "vendor": "Esri",
    "versions": [
      {
        "status": "affected",
        "version": "10.6.1"
      }
    ]
  }
]

References

www.esri.com/arcgis-blog/products/arcgis-enterprise/administration/arcgis-server-security-2021-update-1-patch/

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVE-2021-29107